Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

191–200 of 353 posts

Re: Git password authentication is shutting down

#191

Post by geofft »

sethammons wrote: post #169
geofft wrote: post #93

Earlier quoted context omitted.

Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice." You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst... )" than…

You can actually detect from the server side if curl is being piped and dynamically change the payload.

Yes! I'm not sure how that changes what I'm saying. If you don't trust the server, it can give you a malicious ISO, too.

Or are you saying that you audit the bits of the ISO yourself before burning it?

Re: Git password authentication is shutting down

#192

Post by toastal »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Why are we always teaching Git in the context of GitHub though? There HSA to be a simpler, more platform agnostic way.

Re: Git password authentication is shutting down

#194

Post by DangitBobby »

jcrites wrote: post #156
DangitBobby wrote: post #149

Earlier quoted context omitted.

I actually don't want to rebase. Rebase can rewrite your local history and make it impossible for you to push without doing a force push (or some other more complicated manuevering). The only time pull with rebase is okay (on a shared branch such as master) is when you know that your local branch is strictly behind remote. That's exactly what --ff-only does. It rebases only if you are behind remote, and declines to d…

If "git pull --rebase" succeeds without reporting a merge conflict, then it's tantamount to having executed the command with "--ff-only". I believe you are incorrect however. "git pulll --rebase" will not ever rewrite history from the origin repository. It will only ever modify your local unpublished commits to account for new commits from the origin branch. If your change and the new commits from origin aren't touch…

> "git pulll --rebase" will not ever rewrite history from the origin repository. It will only ever modify your local unpublished commits to account for new commits from the origin branch.

After reading more about it, you are right about that. It will only apply your commits to the tip of remote.

Re: Git password authentication is shutting down

#195

Post by echohack5 »

toastal wrote: post #192
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Why are we always teaching Git in the context of GitHub though? There HSA to be a simpler, more platform agnostic way.

Warning, snarky opinion ahead: because git has terrible cli operations that only make sense to people who under reflog and rebase and the underpinnings of git as opposed to any sort of file-based operations, which is how most people understand computers.

Github looks and behaves like a filesystem with a timeline, which is not accurate to how git works functionally, but that's what makes sense to most people out of the box

Re: Git password authentication is shutting down

#196

Post by Bigpet »

jackcviers3 wrote: post #135
BeefySwain wrote: post #39

Earlier quoted context omitted.

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

I weep for the world now that git is too difficult to understand. It used to explain itself through building your own version of git. You have a file named hash that tracks changes on each file named foo... now all the changes are in a directory named hash...now your changes have to be merged with others... It's kind of up there with next steps after if then else fi. Some things will always be difficult, but diffs an…

The issue is not really the base concept. It's layering a huge amount of concepts on top of it.

Just think of the "places" a change can be in (technically most of these are just labels on the tree, but they have separate commands to deal with them).

Remote, Index, working copy, staging area, stash, branches.

Those are the ones involved in the simples way I know how to make the smallest change. When you get up to stuff like submodules, LFS, subtrees then I very much understand when people get frustrated. All most of them wanted is a slight improvement over copying a folder they named myproject_v23 to a network drive.

Re: Git password authentication is shutting down

#198

Post by judge2020 »

batuhanicoz wrote: post #73
gigel82 wrote: post #55

Earlier quoted context omitted.

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

I think you can achieve this with an SSH config like Host github-personal HostName github.com IdentityFile ~/.ssh/id_rsa_personal Host github-work HostName github.com IdentityFile ~/.ssh/id_rsa_work Then you can use `github-work` or `github-personal` in the remote URL like `git clone git@github-work:mywork/somerepo.git`. edit: I realized after reading the other comments that I got the problem wrong! This would push t…

> This would push the commits from the correct GitHub account but the commits would still have the e-mail from git's config and GitHub would link the account in the committer e-mail.

That seems like a situation where you'd `git config user.email` within your work repo(s) so that it's set locally, not globally. I also think GitHub primarily supports and envisions people using one GH account for work and personal projects.

Re: Git password authentication is shutting down

#199

Post by gertlex »

gigel82 wrote: post #55
vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

I just last night had the idea to put a global git config alias for the `clone` command... Such that it would (1) be preceded by asking me which email I want to use, (2) do the clone, then (3) do `git config user.email bogus@whatever.tld`.

Went to bed early rather than finish that, and this just reminded me of it... (offhand, I wouldn't be surprised if my alias has to be something other than `clone`, but no biggie if so)

Re: Git password authentication is shutting down

#200

Post by cush »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

> How can we offer a more gentle learning curve for budding developers while still requiring "real" projects to use best practices for security and development?

Use literally any GUI. Alternatively, press '.'

Post reply on HN